Computer security using virus probing

Details Computer security using virus probing Computer security using virus probing

1998-01-29

2001-03-20

Wiley, David A. (Department: 2781)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

Reexamination Certificate

active

06205551

ABSTRACT:

FIELD OF THE INVENTION
The present invention relates to network security and, more particularly, to a technique for the verification of security measures employed in computer networks.
BACKGROUND OF THE INVENTION
Advances in communications technology and the availability of powerful desktop computer hardware has increased the use of computers to access a variety of publicly available computer networks. Today, a tremendous amount of information is exchanged between individual users located around the world via public computer networks, e.g., the Internet. One class of users includes private individuals and professional users interconnected via a private network, e.g., a corporate intranet. The exchange of information between private and public computer networks has presented a variety of critical security issues for the protection of information on the private computer networks and the overall functionality of the private computer network itself.
Computer network security, at a minimum, is directed to ensuring the reliable operation of computing and networking resources, and protecting information within the network from unauthorized disclosure or access. Various security threats exist which pose increasingly difficult challenges to such network security. In particular, some of the most sophisticated types of security threats are posed by programs which exploit certain vulnerabilities within network computing systems. To name a few, these program-related security threats include well-known logic bombs, trapdoors, trojan horses, viruses and worms, as described, e.g., by W. Stallings,
Network and Internetwork Security Principles and Practice,
Prentice-Hall, Inc., Englewood Cliffs, N.J., 1995. Such well-known software program threats either work independently (e.g., worms) to achieve their desired security breach, or require the invocation of a host program to be invoked to perform the desired disruptive actions (e.g., trapdoors, logic bombs, trojan horses or viruses.) Indeed, there are numerous well publicized accounts of such programs being used to improperly breach the security of private computer networks and cause severe damage (see, e.g., J. Hruska,
Computer Viruses and Anti
-
Virus Warfare,
Second edition, Ellis Horwood Limited, New York, 1992.) Such damage has included the destruction of electronic files, alteration of databases, or the disabling of the computer network itself or computer hardware connected to the affected network.
Network administrators responsible for the operation of private computer networks employ a variety of security measures to protect the network from external security breaches such as the introduction of computer viruses. One technique uses so-called firewalls. This security scheme essentially places a separate computer system, i.e., the firewall, between the private network and the public network, e.g., the Internet. These the firewalls are software-based gateways that are typically installed to protect computers on a local area network (“LAN”) from attacks by outsiders, i.e., unauthorized users. The firewall maintains control over communications from and to the private network. Essentially, the firewall imposes certain security measures on all users employing the private network. For example, firewalls may block access to new Internet services or sites on the World Wide Web (“WWW”) because the security consequences are unknown or not accounted for by the present firewall configuration. One potential installation configuration of a firewall is that WWW clients can no longer directly contact WWW servers. Typically, this proves too restrictive, and network administrators employ so-called “proxy servers”. Proxy servers are designed with certain features which provide for the forwarding of requests from WWW clients through the firewall thereby providing communication flow to and from servers on the Internet.
Recently, firewall vendors have included so-called “virus filtering” features to address critical security issues associated with virus infection. More particularly, this virus filtering at the firewall is conceptually similar to well-known virus scanning typically employed on client machines, e.g., personal computers, which reside within a LAN in a conventional client/server arrangement. In such client-based virus detection, virus scanning is accomplished using a program which searches through, e.g., the operating system, executable files, system files, boot records, and memory, of the client looking for the presence of undesirable software entities. Computer viruses are detected by the virus scanner by using previously defined “virus signatures” associated with each virus. The virus signature is typically a fixed-length signature pattern, e.g., a 16 to 24 byte pattern, extracted from the known virus by the vendor of the virus scanning software. The virus scanning software contains a list of signatures for known computer viruses and scans the various files in a particular client looking for a match to a particular virus signature. If a match is found, this entity of the client is “infected” and the user is notified accordingly.
The incorporation of virus filtering within commercially available firewalls provides for virus detection by scanning files transmitted through the firewall. While this provides the firewall with additional network security capabilities, implementing the virus filter at the firewall presents certain operational difficulties which include: (1) a substantial amount of processing must be accomplished at the firewall which degrades network performance through the introduction of latency which affects applications executing in the network; and (2) the firewall itself contains less operational and data intelligence with regard to individual clients in the network which leads to a less precise scan of the incoming data by the firewall as could be accomplished by a client-based virus scanner.
Therefore, given the potential drawbacks in firewall-based virus filtering, most network security administrators opt for providing virus screening in the client machines across the network rather than in the firewall itself. Currently, a number of popular commercial computer virus scanners are used for such client-based scanning. Typically, network security administrators will select a particular commercially available virus scanning program and install the program across all the clients of the network. Of course, the effectiveness of the virus scanning software is as function of the uniformity of installation and periodically updating the virus signature listing used by the software to included newly identified viruses. As will be appreciated, for very large client/server networks the task of ensuring that the virus detection software is universally installed and updated on all clients is significant and not always achievable. A client-by-client inspection is labor intensive and cannot be undertaken on a frequent enough basis to ensure conformity. Therefore, individual users are typically responsible for updating their virus scanning software by, e.g., downloading the most current virus signature listing from a central source. Of course, the lack of diligence and infrequency of such updates by individual users can lead to potential secure breaches within the network.
A need exists therefore for ensuring that network security features are universally configured throughout a computer network.
SUMMARY OF THE INVENTION
The present invention provides a technique for determining whether particular clients within a computer network are universally configured in accordance with the desired security features of the computer network. In accordance with the invention, a probe is randomly inserted within incoming files in the computer network. Illustratively, the insertion of probes occurs in a firewall which separates the computer network from other networks. The probe, in accordance with an embodiment of the invention, is configured as a function of a particular execution task, e.g. a known virus, such that in a properly configured client the p

Affiliated with

Also associated with

Rating

Computer security using virus probing does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Computer security using virus probing, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Computer security using virus probing will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2456005